feat(flux): add decryption and postBuild configs

Author: Mafyuh

kubernetes/components/flux-instance/flux-ks.yaml

@@ -15,6 +15,16 @@ spec:
     kind: GitRepository
     name: iac
     namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-config
+      - kind: Secret
+        name: cluster-secrets
   wait: true
   interval: 30m
   retryInterval: 1m

kubernetes/components/flux-instance/flux-token.sops.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: flux-token
+    namespace: flux-system
+type: Opaque
+data:
+    token: ENC[AES256_GCM,data:AZ4LQjSXhtRAsAq+WR9gZXvWzCqao02oTj+6tUrk7u/fPOoOeguwkn6zTzk=,iv:DKctIYcmwFUF/qO2gyG85rtWQ2VouNIuxc1nHVfX2rk=,tag:3lXuPH4lc8f6JcLQemL0AQ==,type:str]
+sops:
+    age:
+        - recipient: age18z6wevr8ze5azvq7nfty3l29s7887l8n5mefr64avhlthtr4uvnqw90nfs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBobDFWT1VacVViTngzcWUw
+            UVlUb2RjdkxENDl2VTcrYlU2Ym1jbHgyTGc0CkxMZVMzMk9KWnl1M3lnMnZsMXo2
+            a0dQakpjM2diVHAzN0tWZWVYTTJpNTgKLS0tIFQ4UEJPclRxbEZKQ0M4THhlQUww
+            UHAwazV4Q0tqYlVzZzR3S2JXY0RlcWcKqiiw5nST35SVoMgk0/5jsILKENJ9xvyY
+            cL4aYBOGo5sgWcG3LBb4/GsIKkcSnBnbusp0W7LrpXFsvNm+P+x2Xg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-10-01T07:02:02Z"
+    mac: ENC[AES256_GCM,data:da0s8CTx/17J5sFW3OEokDDZYI0GZerTdvcxfxUYKllXtOHsqBQOY/LpKY5YjbMTeqBJPdLuu1+A/xKUV8Wz0/9K/Sb/W7up3MPQY2psGx1U5m8nCxKM//YZkCWXigEXgJpDGAgdaz9myCRwP6qYzPA/Ggyk0e7/7QJ16i2WE5U=,iv:UBB295j/CS0RWeooiudcnA4VCJ4lVPOTLX4QkY87Gyk=,tag:OCGsDwp+vyWFcSEo0ewqlA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2

kubernetes/components/flux-instance/receiver.yaml

@@ -9,7 +9,7 @@ spec:
   type: github
   events: ["ping", "push"]
   secretRef:
-    name: FLUX_TOKEN
+    name: flux-token
   resources:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: GitRepository

kubernetes/components/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrelease.yaml
+  - tofu/

kubernetes/components/tofu-controller/kustomization.yaml

@@ -1,5 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - helmrelease.yaml
-  - tofu/
+  - metrics-server/
+  - flux-operator/
+  - flux-instance/